The Australian Signals Directorate (ASD)’s message to government Departments is clear: the question is no longer if a cyber security incident will occur, but when. Although authored by Australia, the Australian Cyber Security Centre (ACSC)’s Modern Defensible Architecture (MDA) reflects joint guidance developed alongside international partners. These include South Korea, Germany, Canada, the Czech Republic, Japan, and New Zealand, underscoring the MDA's relevance to both public and private sector organisations across multiple jurisdictions.

As Departments adopt MDA guidance, they face a common reality: defending increasingly complex, cloud-enabled environments with tools designed for a different era. This is where Wiz plays a critical enabling role.

Reinforcing Layered Architecture (Foundations 1, 5, 6)

Layered architecture recognises that no single control can fully prevent compromise. Departments must implement overlapping defences across identity, workloads, networks, applications, and data to ensure resilience even if one layer fails. Resources are ephemeral, identities and permissions sprawl across environments, and data moves dynamically between services. Most breaches exploit combinations rather than isolated flaws, and traditional security tools struggle to maintain visibility and context.

Regardless of whether Departments adopt a single-cloud, multi-cloud, or hybrid approach, Wiz reduces operational friction. Wiz provides agentless-first, API-driven visibility across cloud environments without performance overhead.

It maintains an always-current view of assets and identities across VMware, AWS, Azure, Google Cloud, and other hybrid and multi-cloud environments. Wiz then connects the dots between exposures and permissions to identify true attack paths, helping teams focus on the highest-impact risks and drive measurable reduction in exposure.

Operationalising Zero Trust (Foundations 2, 3, 6)

MDA is essentially the ACSC’s way of saying security can’t sit at the edge anymore; it must be built into the architecture itself. Zero Trust fails when it’s treated as a philosophy instead of an operational model. This is a challenge that scales exponentially with cloud and AI. While Zero Trust is often narrowly viewed as an end-user access tool, the MDA framework demands these principles be applied deeply within cloud infrastructure.

In this model, Zero Trust succeeds only when enforcement points (like Cloud IAM and network controls) are informed by real-time context rather than static policy. 

Wiz serves as this critical Policy Information Point (PIP), providing the deep visibility into identities and entitlements required to govern access effectively. By continuously analyzing IAM policies to identify excessive permissions, risky trust relationships, and privilege escalation paths, Wiz transforms Zero Trust from a concept into a defensible reality. By generating least-privilege recommendations and highlighting "toxic combinations" across identity-driven attack paths, Wiz enables Departments to align their architecture with MDA’s core intent: adaptive, risk-informed, and truly defensible security.

Ultimately, Wiz provides the governance and continuous verification required to keep Zero Trust from becoming 'set and forget.'

Embedding Secure-by-Design Practices (Foundations 4, 7, 8)

MDA reframes secure-by-design as an architectural outcome that spans the entire lifecycle, including the software supply chain. Wiz supports this by identifying exploitable weaknesses early in code and configuration, tracing runtime risk back to its source, and enabling remediation before insecurity becomes operational debt.

As Australian Government departments increasingly look to leverage AI-driven capability, the rapid instantiation and interconnection of AI and ML-enabled cloud resources materially increases the complexity of supply chain risk, introducing layered dependencies and abstracted control planes that are not governed in the same deterministic manner as traditional IaaS. Wiz responds to this challenge by providing consolidated, context-aware visibility across AI assets, models, identities, and data flows. Wiz delivers a whole-of-system view of the attack surface to support effective governance and risk-informed decision-making.

Compromise can occur at any point in the lifecycle, including via third-party and open-source software, challenging Departments to build systems that remain defensible even when trusted components fail. 

Wiz helps Departments build security into delivery, not bolt it on after deployment. The platform extends protection from code to runtime, identifying risks early in infrastructure-as-code templates, CI/CD pipelines, and live environments. It traces these risks to their source, even down to the specific parameter in a single line of code. This enables remediation at the root cause, reduces downstream exposure, and embeds security into everyday delivery processes.

Continuous Assurance and Informed Decision-Making (Foundations 9, 10)

A modern defensible architecture requires continuous, actionable monitoring rather than periodic assessments against static compliance models. In other words, adopting a continuous Authority To Operate (cATO) regime that keeps pace with dynamic cloud environments. But what executives need isn’t more flashy dashboards and reports. It’s confidence that risk is understood and controlled. Monitoring without context is just data collection. 

Wiz delivers high-fidelity signals with full architectural context, showing what’s at risk, why it matters, and how to remediate efficiently. This reduces Mean Time To Respond (MTTR) and supports confident, timely decision-making. Wiz also provides executive-level insight into risk posture and alignment with ACSC guidance (including ISM and Essential Eight), supporting governance, accountability, and assurance.

Government-Ready Confidence

For Commonwealth Departments, assurance is the bedrock of digital transformation. The Information Security Registered Assessors Program (IRAP) provides a framework for assessing the implementation and effectiveness of an organization’s security controls against the Australian government’s security requirements, as outlined in the Information Security Manual (ISM) and Protective Security Policy Framework (PSPF). Wiz’s commercial product has been evaluated against the PROTECTED ISM controls, effectively removing the friction of protracted custom assessments.

By championing a multi-cloud security strategy, we empower Departments to maintain a consistent security posture across diverse and expanding cloud estates. This unified approach directly supports the Modern Defensible Architecture (MDA) goals of visibility and interoperability, ensuring that even the most sensitive workloads remain secure from code to runtime. Wiz provides the technical foundations necessary for agencies to scale their multi-cloud workloads with absolute confidence.

From Guidance to Resilient Outcomes

Modern Defensible Architecture is a continuous journey. Wiz doesn’t just support MDA; it makes it achievable. As a unified, cloud-native platform, it breaks down silos between development, security, and operations, enabling shared visibility and prioritisation. 

The ACSC’s Modern Defensible Architecture recognises that cyber resilience is no longer achieved through compliance alone, but through architecture that continuously adapts to risk. Wiz welcomes this guidance and looks forward to working with Australian public sector and enterprise organisations to translate architectural intent into sustained, measurable resilience.